SpyBot conflict re: CasaleMedia

Once again, SpyBot's Immunization is removing protection from an IE restricted site placed by SpywareBlaster, specifically, CasaleMedia.com

I realize this happens "every once in a while"... so just reporting the latest instance

 

Yes, Casalemedia protection is disabled by Spybot update.

I wish to once again note that finding the disabled protection is quite tedious, scrolling through as many as 12,299 items, in order to re-check it. As luck would have it, I started my scrolling search at the end of the list (thinking I might find the infamous XTROcash(2) unprotected again). Javacool acknowledged this issue and indicated it might be addressed at some point.

I'd also like to re-ask Javacool this question... it did not receive any official response, and I continue to wonder about it.

--> How can Spybot (or any program, for that matter) disable protections in your program? That doesn't make sense to me. I think of what it would be like if avast! could disable protection against a virus in Avira, or Symantec could disable a BitDefender definition for a trojan? Why is it that SpywareBlaster is in anyway susceptible to what Spybot does or doesn't do?

These are not big issues (well, maybe the disabling of protections by another security app has the potential to be big), and I don't want to come off sounding like I don't appreciate SpywareBlaster!

 

How can Spybot (or any program, for that matter) disable protections in [SpywareBlaster]?

I will venture my personal understanding of the situation --- I believe it's based on two factors: 1) that [aside from TeaTimer,] neither program uses resident protection, and 2) both programs store their Immunization of restricted sites in the Windows Registry.

1) Resident protection runs continually in real-time. As such, it takes up system resources (CPU cycles, and space in RAM). Anti-virus programs (avast, avira, symantec, &etc.) need to run as resident, to continually patrol for, and hopefully "head-off", an infection, before it can take grip of your system. In contrast, both SpyBot (so far as immunization is concerned) and SpywareBlaster, offer passive protection: they load their data once, and that's it... they don't remain resident (meaning they don't use any more CPU/RAM). Being passive (i.e., NON-resident), it's impossible for them to "monitor" changes being made "against" them by another program.
Well, I guess you could say maybe they should be made resident, to monitor for and protect against "attacks". That's certainly a possibility. But keep in mind that to do so would require continual use of CPU and RAM. If SpyBot, SpywareBlaster, and other passive anti-malware programs --- which (aside from IE8) can now all be used together without slowing down a system --- were all made resident to protect themselves against being attacked by another program, the result would probably be noticeable slowdowns, which, in my opinion, would be an even more significant issue for most users... many of whom would rightfully conclude that it was time to abandon these preventive products.

2) Immunization / restricted-site data is stored in the Windows Registry, because that's where Internet Explorer is programmed to look for it. In contrast, anti-virus programs store their program files and data (virus definitions, configuration settings &etc) in proprietary files, typically in their own subdirectory. Since they "own" these files, they can apply whatever forms of protection to them as they deem fit: they can make them "write-only", "hide" them, and if they wish, completely monitor/permit/control any changes being made therein.
The registry, however, is a "general storage house" for all sorts of information, from just about all the programs that get installed on your system. In short, it is --- and must remain --- "universally accessible". No one program (unless you want to say Windows itself) "owns" the registry, so it's next to impossible for a [legitimate] program to "take control" of the registry.
Keep in mind that beside SpyBot and SpywareBlaster, there are other programs (for example, IE-SpyAd) that can place IE restricted sites into the registry. More fundamentally, each user can directly place or remove restricted sites in IE, by going to Tools / Internet Options / Security tab / Restricted Sites --- and if an individual makes an intentional choice to do so, should some program (like SpywareBlaster) be able to refuse to cooperate?

These are just my personal thoughts/understanding of the matter. Hopefully, it may enlighten your perspective of what's happening, and what can be done.

 

Indeed, your explanation has been enlightening. Thank you.

 

I've had the same thing too, but it only seems to show CasaleMedia unprotected once after you've had Spybot open. If you enable all protection, it all stays enabled until you open Spybot again, then the same thing happens.

Why would you need to do this? Surely you can just click on 'Enable All Protection'? If you want to see which item isn't protected against before you enable protection, you can click on 'Restricted Sites' on the left hand side of the program. As 'CasaleMedia' was coloured red, it stood out and was easy to find and the things in 'Restricted Sites' are in alphabetical order too.
All the same it's an irritation which I hope will be sorted soon, although I'm not sure by whom! Spybot I suppose.
Thanks for your explanation ky331, I found it very helpful and interesting.

 

You answered your own question. Why I would need to do this is to see which item isn't protected.

My point about a tedious search is this... the Restricted Sites list has more than 12,000 entries in it. It's a relatively small viewing window (less than 2" tall on my desktop), which means a very minimal amount of scrolling moves through the items on the list very rapidly. Literally hundreds of items are flying by. Even with the red colored item, it's surprisingly easy to overlook, unless you are scrolling slow enough. If you hold the scroll arrow down, the items flying by will be unreadable, and it will still take a very long time to get through 12,000+ items.

As for the list being in alphabetical order... that doesn't help at all if you don't know what you are looking for, does it? As I noted, "As luck would have it, I started my scrolling search at the end of the list (thinking I might find the infamous XTROcash(2) unprotected again)". Try this... try starting at the end of the list and hold down the scroll arrow and see how long it takes you to get to Casalemedia.

It doesn't happen that way for me. Opening Spybot does not disable the SpywareBlaster protection. I believe that running Spybot Immunization will cause that to happen, however.

 

Hi,

Yep - a neat little feature was added per your request in 4.2.

Just right-click on any of the Block Lists, and you should see a new "Find Unprotected" option. That will cycle through any and all unprotected items in each list.

Best regards,

-Javacool

 

Excellent! What I found was, in the case of two items, in order to right-click and cycle through any and all unprotected items in each list, I had to check the first one found and then select Protect Against Checked Items, before the right-click feature would find the next one. But what an improvement! WTG

 

@ Page42
What you say is right of course! I probably don't think things through as well as I should, not to mention probably being a slow scroller!
I agree with you about the new 'Find Unprotected' feature. It's excellent, so thanks to both you and Javacool for this.

 

I also wanted to thank Javacool Software for adding that feature. Big Improvement!

Thanks,
Pat

 

FYI: The CasaleMedia conflict continues, after today's (4/22/2009) SpyBot update...

 

This conflict has finally been rectified with today's (4/27/09) update from SpywareBlaster, which itself removed CasaleMedia.com from its restricted sites.

Thanks to Javacool

 

Perhaps not by coincidence, I have now gotten a few casalemedia pop up ads (this is with IE7's pop-up blocker enabled). I have now added casalemedia.com to my hosts file.